{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://gemacode.org/govp/schemas/govp-1.schema.json",
  "title": "GOVP-1 record",
  "description": "Machine-readable contract for a GOVP-1 operational evidence record. The canonical artifact is the UTF-8 text record defined by the normative specification (https://gemacode.org/govp/spec/govp-1.html); this schema describes its parsed field set and the optional JSON bundle form. Keys here are the canonical lowercase keys produced by a conforming parser.",
  "type": "object",
  "required": [
    "version",
    "canonical",
    "publisher",
    "asset-type",
    "asset-id",
    "asset-sha256",
    "govp-id",
    "evidence",
    "signature"
  ],
  "properties": {
    "version": {
      "description": "Wire-format version. Any other value is a different format.",
      "const": "GOVP-1"
    },
    "canonical": {
      "description": "Absolute HTTPS URL of the issuing identity, normally https://<domain>/.well-known/govp.txt. Binds the record to its domain.",
      "type": "string",
      "format": "uri",
      "pattern": "^https://"
    },
    "publisher": {
      "description": "Human-readable name of the declaring party.",
      "type": "string",
      "minLength": 1
    },
    "asset-type": {
      "description": "Registered asset type, lowercase. See the type-code registry (spec section 8).",
      "type": "string",
      "enum": ["document", "dataset", "model", "agent", "pipeline", "benchmark"]
    },
    "asset-id": {
      "description": "Stable identifier of the asset within the publisher's namespace. Case-sensitive; not lowercased during GOVP-ID derivation.",
      "type": "string",
      "minLength": 1
    },
    "asset-sha256": {
      "description": "Lowercase hex SHA-256 of the asset bytes.",
      "type": "string",
      "pattern": "^[0-9a-f]{64}$"
    },
    "govp-id": {
      "description": "Content-derived identifier: 'GOVP-' + TYPECODE + '-' + first 12 hex chars of SHA256(asset-type LF asset-id LF asset-sha256). Verifiers recompute and compare.",
      "type": "string",
      "pattern": "^GOVP-(DOC|DATA|MODEL|AGENT|PIPE|BENCH)-[0-9a-f]{12}$"
    },
    "evidence": {
      "description": "URL where the declared asset, or its statement, is published.",
      "type": "string",
      "format": "uri"
    },
    "signature": {
      "description": "Base64-encoded 64-byte Ed25519 signature over the canonical signing input (spec sections 5-6).",
      "type": "string",
      "pattern": "^[A-Za-z0-9+/]{86}==$"
    },
    "public-key": {
      "description": "Base64-encoded 32-byte raw Ed25519 public key. Required in practice: a record without it cannot pass signature verification.",
      "type": "string",
      "pattern": "^[A-Za-z0-9+/]{43}=$"
    },
    "generated-at": {
      "description": "RFC 3339 UTC issuance time. Issuer-asserted unless an anchoring profile is used - see security considerations 12.1.",
      "type": "string",
      "format": "date-time"
    },
    "profile": {
      "description": "Named profile. Time-anchoring profiles carry cryptographic meaning; sector profiles label the use case only. A profile that is not a time-anchoring profile MUST be treated as GOVP-BASIC for time purposes.",
      "type": "string",
      "examples": [
        "GOVP-BASIC",
        "GOVP-RFC3161",
        "GOVP-QTSP",
        "industrial-manufacturing",
        "quality-inspection",
        "compliance-control",
        "esg-disclosure",
        "audit-evidence",
        "release-record",
        "website-integrity"
      ]
    },
    "license": {
      "description": "License of the published evidence.",
      "type": "string",
      "examples": ["CC-BY-4.0"]
    }
  },
  "additionalProperties": {
    "description": "Unknown fields are preserved and included in the signing input. Verifiers must not fail on fields they do not recognize.",
    "type": "string"
  },
  "$defs": {
    "bundle": {
      "title": "GOVP-1 JSON bundle",
      "description": "Optional machine-consumption companion of a text record. The text record remains canonical; asset.hash.value must equal the record's asset-sha256.",
      "type": "object",
      "required": ["format", "record", "asset"],
      "properties": {
        "format": { "const": "GOVP-1" },
        "record": {
          "description": "The record fields, keyed by display name (Version, Canonical, ...).",
          "type": "object"
        },
        "asset": {
          "type": "object",
          "required": ["type", "id", "hash"],
          "properties": {
            "type": { "type": "string" },
            "id": { "type": "string" },
            "hash": {
              "type": "object",
              "required": ["alg", "value"],
              "properties": {
                "alg": { "const": "sha256" },
                "value": { "type": "string", "pattern": "^[0-9a-f]{64}$" }
              }
            }
          }
        },
        "verification": {
          "description": "Optional record of a verification performed by the bundle's producer. Informational only: a consumer must re-verify.",
          "type": "object"
        }
      }
    },
    "verificationResult": {
      "title": "Verification result",
      "description": "The per-check breakdown a conforming verifier reports. Never a bare boolean. 'canonical' and 'asset' are null when not evaluated.",
      "type": "object",
      "required": ["ok", "checks"],
      "properties": {
        "ok": {
          "description": "Core-valid: every applicable check passed.",
          "type": "boolean"
        },
        "checks": {
          "type": "object",
          "properties": {
            "format": { "type": "boolean" },
            "signature": { "type": "boolean" },
            "govpid": { "type": "boolean" },
            "canonical": { "type": ["boolean", "null"] },
            "asset": { "type": ["boolean", "null"] }
          }
        }
      }
    },
    "sourceState": {
      "title": "Sources Verification Layer state",
      "description": "The verifiable state of a source in the SVL. Only 'verified' sources feed trust computation.",
      "type": "string",
      "enum": ["verified", "failed", "expired", "revoked", "unavailable", "declared_only"]
    }
  }
}